The widespread sharing of face images on social media platforms and in large-scale datasets raises pressing privacy concerns, as biometric identifiers can be exploited without consent. Face anonymization seeks to generate realistic facial images that irreversibly conceal the subject's identity while preserving their usefulness for downstream tasks. However, most existing generative approaches focus on identity removal and image realism, often neglecting facial expressions as well as photometric consistency -- specifically attributes such as illumination and skin tone -- that are critical for applications like relighting, color constancy, and medical or affective analysis. In this work, we propose a feature-preserving anonymization framework that extends DeepPrivacy by incorporating dense facial landmarks to better retain expressions, and by introducing lightweight post-processing modules that ensure consistency in lighting direction and skin color. We further establish evaluation metrics specifically designed to quantify expression fidelity, lighting consistency, and color preservation, complementing standard measures of image realism, pose accuracy, and re-identification resistance. Experiments on the CelebA-HQ dataset demonstrate that our method produces anonymized faces with improved realism and significantly higher fidelity in expression, illumination, and skin tone compared to state-of-the-art baselines. These results underscore the importance of feature-aware anonymization as a step toward more useful, fair, and trustworthy privacy-preserving facial data.
Figures & tables
Fig. 1: Comparison of canonical image processing methods for face anonymization. From left to right are masking, blurring, pixelation, noise, and generation [ 11 ] .
Fig. 2: Comparison of pose-conditioning landmarks for anonymization. (a) Sparse set of seven landmarks extracted with Mask R-CNN [ 49 ] , covering only ears, eyes, nose, and shoulders as in the original DeepPrivacy framework. (b) Dense set of 68 facial landmarks detected with the DLib implementation of [ 50 ] , providing finer geometric detail and enabling more faithful expression preservation.
Fig. 3: Relighting pipeline. The original image Io and anonymized image Ia are decomposed into albedo ( A ) and shading ( S ) components. The shading of Io is combined with the albedo of Ia , and a Laplacian pyramid is used to refine consistency across spatial frequencies, producing the blended output Iblend .
Fig. 4: Albedo, normal and shading images estimated for a face image by the SfSNet model [ 54 ] .
Dimension
Metric
Description / Computation
Image Quality
FID ImageNet
Fréchet Inception Distance computed in ImageNet-pretrained Inception feature space [ 48 ] . Lower is better.
FID CLIP
FID computed in CLIP embedding space for semantically aligned evaluation [ 56 ] .
Detection Rate
Percentage of anonymized images where MTCNN detects a valid face [ 57 ] . Higher is better.
Privacy
Cosine Similarity of Identity Embeddings
Cosine similarity between FaceNet embeddings of original and anonymized images, using two FaceNet versions (VGGFace2 and CASIA-WebFace) [ 58 , 59 , 60 ] . Lower indicates better anonymization.
Face Re-identification Rate
Percentage of original-anonymized pairs matched by a re-identification network above a similarity threshold.
Geometry
Pose Preservation
Normalized L 1 distance between 68 facial landmarks detected by DLib [ 50 , 51 ] . Lower is better.
TABLE I: Summary of Evaluation Metrics Used for Anonymization Performance Assessment. Metrics are grouped by evaluation dimension, with their purpose and computation method explicitly stated.
Method
Year
FID ImageNet ( ↓ )
FID CLIP ( ↓ )
Face detection ( ↑ )
Face re-identification ( ↓ )
Pose estimation ( ↓ )
Inference time ( ↓ )
VGGFace2
CASIA-WebFace
AIDPro [ 30 ]
2025
26.63
14.48
98.79
0.1532 ± 0.1591
0.2140 ± 0.1470
0.0500
0.02
AnonyGAN [ 55 ]
2022
60.23
19.34
96.79
0.3892 ± 0.1546
0.3768 ± 0.1408
0.0339
0.10
CIAGAN [ 14 ]
2020
1.78
34.00
95.25
0.1796 ± 0.1658
0.2172 ± 0.1432
0.0791
0.08
DeepPrivacy [ 11 ]
2019
32.50
21.10
97.24
0.1917 ± 0.1748
0.2170 ± 0.1514
0.0520
0.12
DeepPrivacy2 [ 18 ]
2022
15.08
11.69
95.84
0.1738 ± 0.1681
0.2063 ± 0.1507
0.0946
0.28
TABLE II: Comparison of common anonymization performance metrics across state-of-the-art methods. We report visual quality (FID ImageNet , FID CLIP ), face detection rate, identity similarity using FaceNet embeddings (VGGFace2 and CASIA-WebFace), pose preservation error (normalized L 1 distance), and average inference time per image. ↓ indicates lower is better, ↑ indicates higher is better. Best and second-best results are highlighted in blue and red respectively.
Method
Landmark error ( ↓ )
Facial expression acc. ( ↑ )
AIDPro [ 30 ]
0.0510
63.91
AnonyGAN [ 55 ]
0.0321
73.11
CIAGAN [ 14 ]
0.0801
56.55
DeepPrivacy [ 11 ]
0.0513
53.29
DeepPrivacy2 [ 18 ]
0.0973
51.23
FALCO [ 17 ]
0.0598
59.43
TABLE III: Evaluation of facial expression preservation using normalized landmark error (51 expression-related landmarks) and emotion classification accuracy. Lower values ( ↓ ) indicate better landmark alignment, higher values ( ↑ ) indicate better expression consistency. Best and second-best results are highlighted in blue and red respectively.
Method
Si-MSE ( ↓ )
Si-L 2 ( ↓ )
AIDPro [ 30 ]
0.0314 ± 0.0122
0.0131 ± 0.0073
AnonyGAN [ 55 ]
0.0359 ± 0.0205
0.0146 ± 0.0081
CIAGAN [ 14 ]
0.0792 ± 0.0392
0.0185 ± 0.0095
DeepPrivacy [ 11 ]
0.0549 ± 0.0355
0.0163 ± 0.0095
DeepPrivacy2 [ 18 ]
0.0838 ± 0.0516
0.0211 ± 0.0124
FALCO [ 17 ]
0.0654 ± 0.0386
0.0163 ± 0.0088
TABLE IV: Lighting direction preservation evaluated using scale-invariant Mean Squared Error (Si-MSE) and scale-invariant L 2 distance (Si-L 2 ) between the original and anonymized faces. Lower values ( ↓ ) indicate better preservation. Best and second-best results are highlighted in blue and red respectively.
Method
Si-MSE
MSE-L
MSE-ab
ΔE
AIDPro [ 30 ]
3.60 ×10−7
0.1241 ± 0.1316
0.1426 ± 0.1128
10.30 ± 9.46
AnonyGAN [ 55 ]
3.19 ×10−7
0.1053 ± 0.1083
0.1269 ± 0.0945
9.03 ± 7.84
CIAGAN [ 14 ]
6.82 ×10−7
0.2153 ± 0.2320
0.2289 ± 0.1976
17.26 ± 16.61
DeepPrivacy [ 11 ]
4.76 ×10−7
0.1482 ± 0.1675
0.1710 ± 0.1446
12.27 ± 12.06
DeepPrivacy2 [ 18 ]
6.40 ×10−7
0.2087 ± 0.2353
0.2226 ± 0.2010
16.73 ± 16.87
FALCO [ 17 ]
4.89 ×10−7
0.1605 ± 0.1457
0.1772 ± 0.1264
13.08 ± 10.50
TABLE V: Skin color preservation evaluated using SiMSE, lightness error (MSE-L), chroma error (MSE-ab), and perceptual difference ( ΔE2000 ) between original and anonymized faces. Lower values indicate better color consistency. Best and second-best results are highlighted in blue and red respectively.
Fig. 5: Aggregated performance across five evaluation dimensions: image quality, privacy, geometry, lighting, and color. Each axis represents the normalized average score for a dimension, where higher values indicate better performance.
Fig. 6: Anonymization results on CelebA-HQ.
68 Landmarks
Relighting
Lapl. Pyr.
FID ImageNet
FID CLIP
Face det.
Face re-identification
Pose estim.
Facial expr.
Light. (SiMSE)
Skin color ( ΔE )
VGGFace2
CASIA-WebFace
✗
✗
✗
32.50
21.10
97.24
0.1917
0.2170
0.0520
53.29
0.0549
12.27
✓
✗
✗
9.85
7.20
99.35
0.2193
0.2237
0.0360
72.40
0.0430
9.74
✓
SfSNet
✓
30.21
17.52
95.33
0.4641
0.4671
0.0339
74.62
0.0363
10.71
✓
Intr. Decom.
✗
7.50
6.02
98.94
0.2331
0.2366
0.0392
74.77
0.0208
9.36
✓
Intr. Decom.
✓
10.54
8.27
98.04
0.2125
0.2184
0.0334
75.00
0.0137
8.93
TABLE VI: Ablation study. Effect of facial landmark alignment, relighting method, and Laplacian pyramid refinement on image fidelity, recognition, and lighting and color consistency metrics. The best resultas are highlited in blue and red respectively.